Quantum Audit Logo

Is Gitcoin Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Gitcoin GTC
0xde30…163f
Ethereum
Not verifiedThis record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked today 1 audit on record
DexScreener ↗
How is this score calculated? → Medium Risk
Executive SummaryAI Copilot

The GTC contract is an ERC-20 compatible token. A key finding highlights that a privileged 'minter' address possesses the capability to mint new tokens, which can lead to the dilution of existing token holders. This centralized control over the token supply represents a significant economic risk.

3 Medium3 Informational
Volume 24h
$241.8K
Liquidity
$172.9K
Price
$0.1306
Token Age
5y
Top 10 Holders
68.0%

Security Findings

3 Med3 Info
Medium

Centralized Control Over Token Supply (Minting Capability)

CP-01The `mint(address,uint256)` function allows a specific address, designated as the `minter`, to create new GTC tokens. This increases the total supply of GTC, which can dilute the value of existing tokens held by other users. The `minter` can also change the `minter` address itself via `setMinter(address)`, concentrating significant power in a single entity.
IssueThe `mint(address,uint256)` function allows a specific address, designated as the `minter`, to create new GTC tokens. This increases the total supply of GTC, which can dilute the value of existing tokens held by other users. The `minter` can also change the `minter` address itself via `setMinter(address)`, concentrating significant power in a single entity.
FixToken holders should be aware that the `minter` address has the power to increase the token supply. To mitigate this risk, the project team should consider implementing a multi-signature wallet or a time-locked governance mechanism to control the `minter` address and the `mint` function, reducing reliance on a single entity.
StatusUnresolved
Medium

Liquidity not locked

QA-LIQUIDITY0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 2 address(es) other than the owner/deployer. One of them — a wallet, 0xd6c5…2e8c — holds 98.9% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 76% of the token's DEX liquidity; the other pools were not assessed.
Issue0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 2 address(es) other than the owner/deployer. One of them — a wallet, 0xd6c5…2e8c — holds 98.9% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 76% of the token's DEX liquidity; the other pools were not assessed.
FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.
StatusAcknowledged
Medium

The market for this token

QA-MARKETLiquidity $228K (DexScreener, all pools). 24h trading volume $59.5M (CoinGecko, all markets, daily snapshot). 24h trading volume $287K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $22.37 on 2021-11-26; the price is now 99.3137% below it.
IssueLiquidity $228K (DexScreener, all pools). 24h trading volume $59.5M (CoinGecko, all markets, daily snapshot). 24h trading volume $287K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $22.37 on 2021-11-26; the price is now 99.3137% below it.
FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
StatusAcknowledged
Info

Who holds the supply

QA-HOLDERSThe ten largest holders own 68.0% of supply. What remains: 50.2% in wallets, 17.8% in other contracts. The owner address holds 12.5% — it is a governance timelock (48h delay), so any sale of that share needs a public, delayed transaction. 89,221 holders in total.
IssueThe ten largest holders own 68.0% of supply. What remains: 50.2% in wallets, 17.8% in other contracts. The owner address holds 12.5% — it is a governance timelock (48h delay), so any sale of that share needs a public, delayed transaction. 89,221 holders in total.
FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
StatusAcknowledged
Info

Identity verified by independent sources

QA-IDENTITYListed on CoinGecko as Gitcoin (GTC), market cap $13M, rank #1113. Traded on Binance, Coinbase. 89,221 holders. Verified by: CoinGecko, exchange listings.
IssueListed on CoinGecko as Gitcoin (GTC), market cap $13M, rank #1113. Traded on Binance, Coinbase. 89,221 holders. Verified by: CoinGecko, exchange listings.
FixMatch the contract address against the project's official channels before trading.
StatusAcknowledged
Info

Asset class: Governance token

QA-PROFILEA token whose main use is voting on a protocol's decisions (delegation and vote checkpoints in its code). The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Governance. Tokenomics — Supply: mintable with no on-chain cap found. Control: minter — a timelock with a 48h delay. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $228K of DEX liquidity across 13 pools. Launch: 1955 days of market history.
IssueA token whose main use is voting on a protocol's decisions (delegation and vote checkpoints in its code). The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Governance. Tokenomics — Supply: mintable with no on-chain cap found. Control: minter — a timelock with a 48h delay. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $228K of DEX liquidity across 13 pools. Launch: 1955 days of market history.
FixCheck how much of the voting supply insiders hold and what governance can change.
StatusAcknowledged

Category Ratings

TechnicalLow8/10

The GTC contract implements standard ERC-20 functionalities for token transfers and approvals. A central technical control is the 'minter' address, which can call `mint(address,uint256)` to increase the total supply (7.2 Code Security). The `minter` also has the power to update the `minter` address itself via `setMinter(address)` and the `GTCDist` address via `setGTCDist(address)`, indicating a high degree of administrative control (7.3 Access Control). The `GTCDist` address controls the `delegateOnDist` function, which affects delegation mechanics.

GovernanceHigh1/10

The economic model of the GTC token allows for supply inflation through the `mint` function, which is controlled by a single 'minter' address (7.4 Economic). This introduces a centralization risk where the 'minter' can unilaterally increase the token supply, potentially diluting existing token holders. While there are internal checks like `mintCap` and `minimumTimeBetweenMints` to regulate the minting rate, the ultimate decision-making power rests with the 'minter'. The `GTCDist` address also holds significant control over delegation, impacting potential governance mechanisms (7.5 Governance).

UpgradesHigh3/10

The GTC contract is not designed with an upgrade proxy pattern, meaning its logic cannot be changed after deployment (7.7 Upgrades). This eliminates risks associated with upgrade mechanisms, such as proxy implementation bugs or insecure upgrade paths. However, it also means that future bug fixes or feature enhancements would require a full redeployment and migration of token holders.

Security Checklist

2/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyPass
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

68.0% in top 10
50.2% in wallets17.8% in contracts
Effective Concentration57.3%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$227.8K across 13 pairs
Uniswap v3WETHanalysed$172.9K75.9%Uniswap v2WETH$33.3K14.6%Uniswap v3WETH$12.9K5.6%BalancerWETH$7.7K3.4%BalancerAAVE$5400.2%BalancerBAL$5380.2%
Show 2 more pairsShow less
Uniswap v4ETH$430.0%SushiswapUSDC$70.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder98.9%
Top-3 Unlocked100.0%

Key Addresses

11 addresses
Deployer
0x4110…0290
Unlocked LP Held By
0xd6c5…2e8c0x5210…0e220x09dc…209d0x61bc…e71f0x80af…c4130x8fbe…2d410x789d…17340x3aa6…cd2c0x81d0…08b50x59e3…91ee

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

3 factors
  • Mintable supply — no cap found, dilution unbounded; held by minter: Timelock
  • Liquidity NOT locked (100% of the pool; this pool is 76% of DEX liquidity) — held by independent providers — market-depth risk
  • Top-10 concentration > 50% (68.0% total → 57.3% effective; 50.2% in EOAs, 17.8% in contracts)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Octra (OCT)Medium RiskProgrammable (V4)Medium RiskZigCoin (ZIG)Medium RiskLiquid staked Ether 2.0 (STETH)Medium RiskChainlink (LINK)Medium RiskKiteMedium Risk

Would You Like a More Detailed Audit of Gitcoin?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit